More than two years ago, Islamist fighters swept into the U.S. consulate in Benghazi, Libya. They set the complex on fire, killing the U.S. ambassador and a foreign service officer. Two security contractors also died in the assault.

The assault set off a veritable political war inside the United States–with Congress directing the State Department to add security at far-flung and vulnerable embassies and consulates. The U.S. also created a rapid-response Marine unit based at Quantico, Virginia to rush into crisis zones if it appeared another Benghazi might happen again. But according to a recent audit from the State Department’s inspector general, only a few diplomatic outposts deemed at risk of attack have seen much increase in armed security provided by the Marines. “The Department had made only limited progress in the critical area of adding new Marine Security Guard detachments to high threat posts that were most in need of additional security,” the report states.

To put it another way, the most vulnerable U.S. embassies are–surprise–still vulnerable. This is a big deal because the U.S. has a large diplomatic presence. Washington has embassies, consulates and other diplomatic posts scattered around the world, and often relies on local security forces to handle protection. But local contractors are not always as reliable as soldiers wearing American uniforms. It’s also far from what the State Department planned after the terror group Ansar al-Shari’a assaulted the U.S. consulate in Benghazi. Before the attack, the State Department had around 1,400 Marines assigned as embassy guards around the world. After the attack, Congress ordered the ministry to toughen its defenses by 1,000 Marines globally.

The State Department was under orders to bolster its Marine guards at its highest-risk foreign posts. The Benghazi consulate–before the Islamists destroyed it–relied on private contractors and local militias for its defense. The new Marine detachments would help boost security at 50 diplomatic posts that previously had no Marine guards. But lack of funds soon whittled the number of reinforced embassies down to 25. For the outposts on the schedule to receive reinforcements, the State Department considers 15 of these posts–or 60 percent–to not be particularly vulnerable to attacks. Listings of specific posts in the report have been heavily redacted for security reasons.

But the report praises the Marine Security Augmentation Unit, or MSAU. The Virginia-based force of 122 Marines–divided into nine squads–is now ready to deploy on short notice. But this still leaves a lot of the highest-risk posts weakly defended. One problem is that a lot of high-risk areas don’t have the infrastructure to support the Marines. It costs about $15 million–on average–to build the structures needed to house and protect a Marine detachment. However, the service also has a 550-strong SP-MAGTF force–or Special Purpose Marine Air-Ground Task Force Crisis Response–based in Spain tasked with a wider set of missions in Africa including embassy protection.

The State Department was also under intense pressure to deploy Marines as fast as possible, “which may have detracted from prioritization of high threat posts,” the report states. But the rush to defend the embassies might not prevent the next attack.